[GNUnet-SVN] r31175 - gnunet/src/set

[gnunet]

Author: grothoff
Date: 2013-12-08 21:40:27 +0100 (Sun, 08 Dec 2013)
New Revision: 31175

Modified:
   gnunet/src/set/gnunet-service-set.c
Log:
fix use-after-free: the call to mesh_channel_destroy will ultimately free 'op', 
so we must not update 'op' after the call; however, it is a good idea to clean 
up the 'channel' field just before the call (#3164)

Modified: gnunet/src/set/gnunet-service-set.c
===================================================================
--- gnunet/src/set/gnunet-service-set.c 2013-12-08 19:25:46 UTC (rev 31174)
+++ gnunet/src/set/gnunet-service-set.c 2013-12-08 20:40:27 UTC (rev 31175)
@@ -284,6 +284,7 @@
 _GSS_operation_destroy (struct Operation *op)
 {
   struct Set *set;
+  struct GNUNET_MESH_Channel *channel;
 
   if (NULL == op->vt)
     return;
@@ -316,10 +317,10 @@
     op->mq = NULL;
   }
 
-  if (NULL != op->channel)
+  if (NULL != (channel = op->channel))
   {
-    GNUNET_MESH_channel_destroy (op->channel);
     op->channel = NULL;
+    GNUNET_MESH_channel_destroy (channel);
   }
 
   collect_generation_garbage (set);